AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[Turbofan] Fixes crash on missing BigInt.asUintN argument

Browse Source 
Bug: chromium:1029576
Change-Id: If647f764da2682a0f278b9b8060d0665fab1c40c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1948711
Commit-Queue: Georg Neis <neis@chromium.org>
Auto-Submit: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65312}
This commit is contained in:
Nico Hartmann 2019-12-03 15:52:17 +01:00 committed by Commit Bot
parent d406c672bc
commit e76d29b35e
2 changed files with 20 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/compiler/js-call-reducer.cc
View File

@ -7609,7 +7609,7 @@ Reduction JSCallReducer::ReduceBigIntAsUintN(Node* node) {
if (p.speculation_mode() == SpeculationMode::kDisallowSpeculation) {
return NoChange();
}
if (node->op()->ValueInputCount() < 3) {
if (node->op()->ValueInputCount() < 4) {
return NoChange();
}

19
test/mjsunit/regress/regress-1029576.js Normal file
View File

@ -0,0 +1,19 @@
// Copyright 2019 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
function f() {
try {
return BigInt.asUintN(8);
} catch(_) {
return 42n;
}
}
%PrepareFunctionForOptimization(f);
assertEquals(42n, f());
assertEquals(42n, f());
%OptimizeFunctionOnNextCall(f);
assertEquals(42n, f());